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Foreword 


The Information Commissioner's Office (ICO) has tracked awareness and 
understanding of the Data Protection Act 1998 (DPA) since 1997 and the 
Freedom of Information Act 2005 (FOIA) since 2004. 


The research was reviewed in 2007 to form a more focussed and respondent- 
friendly consultation, whilst still meeting the needs of the ICO’s core research 
objectives. 


1.0. Introduction 


Since the revised DPA came into force in 1998, the ICO has monitored 
awareness and understanding of this legisation amongst practitioners 
(private and public sector). 


The FOIA was passed in 2000 and was fully enforced at the start of 2005. This 
Act govems public authorities only. Research is undertaken to monitor 
awareness and understanding of the Act amongst public authorities. 


SMSR Ltd has conducted this research - which takes the fom of an annual 
track survey - on behalf of the ICO since 2004. 


Research is also undertaken amongst individuals to measure awareness and 
understanding of each of the Acts. Findings are detailed in a separate 
report. 


2.0 Research Aims and Objectives 


Where applicable this report contains and compares the results from 2007 to 
2010. 


The research objectives of the consultation were as follows; 
2.1. DPA Objectives: 


To identify: 
e Awareness of rights of individuals about whom information is stored. 
e Awarenessof organisations obligations under the Act. 
e Perceived benefits of the DPA. 


2.2. FOIA Objectives: 


To identify: 
e Awareness of rights of individuals with regards to freedom of 
information. 
e Awarenessof public authorities’ obligations under the Act. 
e Perceived benefits of the FOIA. 


2.3 Corporate Awareness Objectives: 
e To identify awareness of the ICO as being responsible for the DPA and 
FOIA. 
2.4 ICO Communications Objectives: 


It is helpful to read this report in the context of the ICO’s communications 
objectives for organisations, which are detailed as follows: 


e Raise organisations’ awareness of their obligations; and 
e Reinforce the ICO's positioning as the authoritative arbiter of 
information rights. 


3.0 Executive Summary 


The findings from both the DPA and FOIA perspective are extremely postive 
and despite organisations trading and operating in times of austerity. There is 
gil great value placed upon both Acts, and the majority agreed that the 
Actsare beneficial and very much needed. 


Awareness of key DPA obligations have increased significantly, with 
awareness to keep personal information secure increasing by 18% Awareness 
of all DPA obligations has increased and now almost mirrors the highs of 2007. 
Encouragingly this has been driven by the private sector, where historically 
awareness has been low. 


Awareness of the right to see information under the DPA wasagain very high 
both prompted and unprompted and overall awareness of all rights 
unprompted has increased. 


The ICO still dominate as the source of information for both the DPA and the 
FOIA and is sill identified the most frequently as the enforcer of both Acts (the 
highest levels of awareness since tracking began). There is also an increase in 
levels of understanding and awareness of notification. 


Like data protection, there has been an increase in unprompted awareness 
of obligations under the FOIA and although prompted awareness had 
marginally decreased it is still extremely high. Unprompted awareness of all 
rights has increased significantly. 


3.1 Data Protection 
Obligations 


Spontaneous awareness of all obligations has increased significantly since 
2010 and awareness of the obligation to keep personal information secure 
hasincreased by 54%to 72%- the highest recorded level of awareness. 


In contrast to last year these increases have been driven by greater 
awareness among private sector organisations, whereas public sector 
awareness remains high but static. 


As with previous years, the number one principle cited spontaneously is 
security, although almost half mentioned the responsbility to keep 
information accurate and up to date (46%) and to process information in a 
fairand lawful manner (45%). 


Prompted awareness of all obligations is still very high across both sectors. 


Rights 


Unprompted awareness of individuals’ right to see information has slightly 
decreased to 85% (-4%), yet this still represents the second highest recorded 
awareness levels since the tracking began. In addition awareness of all other 
rights has increased with awareness of the individual's right to corect 
inaccurate information increasing from 14% in 2010 to 25% in 2011. 


Prompted awareness of individuals’ rights continues to be very high and has 
largely remained stable year on year. The vast majority of organisations 
(95%+) correctly identified that individuals have the right to see information 
held about them, have the right to have the breach of the Act investigated 
and assessed, and have the right to correct inaccurate information. 


Enforc ing the DPA 


Awareness of the ICO as being the enforcer of the DPA has never been as 
high, as 70% mentioned the ICO; a 16% increase from 2010. The private 
sector has been the catalyst for the significant increase, although the gap 
between the private and public sector still remains large at 35%. Awareness 
amongst the public sector remains consistently high at 88% compared to 53% 
in the private sector. 


Notification 


Overall, there has been an increase in levels of understanding conceming 
notification as most agreed it isa legal requirement (87%) and agreed that 
even if an organisation does not need to notify they must still comply with the 
DPA principles (86%) 


The public sector continues to show higher levels of awareness; however the 
private sectors awareness levels have increased significantly since 2010. 


Implications of the DPA 

The perceived value and benefits of the DPA remain very positive as 95% of 
all organisations agree that the Act is needed. In addition, over 90% believe 
the DPA improves customer trust and improves information management. 
Public sector organisations were more likely than private organisations to be 
more positive about the Act; however the private sector were much more 
positive about the Act than they were 12 monthsago. 


Personal information requests 


Across both sectors there has been an increase in the amount of requests 
that organisations have received, with just 29% of respondents suggesting 


they had received no requests. This is a 10% decrease from last year and is 
the lowest figure recorded since tracking began. 


3.2 Freedom of infomation 
Obligations 


Spontaneous awareness of all obligations regarding the FOIA have increased 
for the second consecutive year there has been an increase of 9% in 
spontaneous awareness of the obligation: public authorities must provide 
information through a publication scheme; with awareness now at 58% 
Unprompted awareness of the obligation to respond to requests within 20 
working daysis once again the statement with the highest level of agreement 
(68%); this has increased significantly by 10% since 2010. 


Prompted levels of awareness were once again very high (94%t+). 
Rights 


More than nine out of ten respondents (91%) mentioned the public’s right to 
request information held by the Govemment and other public authorities, this 
is a further 2% increase from 89% in 2010. Unprompted awareness of all other 
rights has also increased. 


Prompted awareness of individuals’ rights remains extremely high in 2011 and 
awareness is consistent with the previous four years. 


Enforcing the FOIA 


The majority (86%) of public authorities were aware of the ICO’s responsibility 
for enforcing the FOIA; a 2%increase since 2010. Awareness was once again 
loweramongst small/medium sized organisations. 


Implications of the FOIA 


More than eight of every ten respondents believe the FOIA is needed (84%), 
improves record management (84%) and increases trust (81%). Compared to 
last year 11% more respondent said that the FOIA improves customers trust. 
Authorities have remained positive with regards to how the FOIA has 
benefited their organisation, with agreement on the positive statement 
generally increasing and levels of agreement decreasing on all negative 
statements. 


Information requests 
The volume of information requests under the FOIA have increased, however 


it is perhaps not as Sgnificant as in previous years, with just marginal increases 
in 200+ requests. Lessthana tenth (9%) said they had received no requests in 
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the last 12 months and it isthe small/medium sized organisations that seem to 
have experienced the more significant increases in information requests. 


Almost two thirds (63%) of respondents said the number of requests given 
represented an increase for their organisation. Only 4% of organisations had 
received fewer requests than the 2010. 


3.3 Information Commissioner's Office 


Awareness of the ICO, when prompted is 90%; this represents a 12% increase 
since 2010 and is the highest recorded level of awareness since tracking 
began.. 


Last year awareness in the private sector (58%) was the lowest recorded since 
2007 but has now increased to 81% and is the main reason for the overall 
increase. Public sector awareness remains consistently high at 99% 


The ICO is the main source of advice for both the DPA and the FOIA. The 
ICO’s website was the favoured source of information for advice on both the 
DPA (55%) and FOIA (71%), with contact with the ICO via telephone the 
second favoured source for both DPA (27%) and FOIA (32%). 


4.0 Methodology 


The consultation was undertaken by telephone to retain consistency with 
previous years. 


Quotas were placed on organisation by size, thus allowing vanations between 
larger and smaller organisations to be identified. Quotas were also set on 
industry to ensure all types of organisations were interviewed. 


Amongst public authorities, a separate interview was required for the FOI 
section in 11% of instances (i.e. the person interviewed was not responsble for 
the FOIA but was responsible for the DPA). This has decreased by 10% since 
2010 and 20%since 2009. 


All of the interviews were conducted in house by SMSR’stelephone team. The 
majorty of interviewers had previously worked on ICO projects. All were 
regulary monitored by the call centre’s quality manager and supervisors as 
part of SMSR’sISO accredited Quality Management System. 


It should be noted that when the results are discussed within the report, often 
percentages will be rounded up or down to the nearest one per cent. 
Therefore, occasionally figures may add up to 101% or 99%. 


Explanation of the use of R? in graphs throughout the report: 

R? tells us what fraction of the variance of the data is explained by the fitted 
trend line. R? ranges from O to 1; with a value closer to 1, data is better 
explained by the trend line, or the trend line is more fitted to the data. In our 
charts, the bigger the value, the stronger trend the data has across time, 
therefore the more confident we can be in predicting next year’s figures. 


Fieldwork wascamied out between 8 August and 3% September 2011. 
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5.0 Sample / Profile 


The required sample size for organisations was 800 (400 private and 400 public 
sector based). The achieved sample was 806. 


Size of Organisation 


The sample structure allowed analysis to be undertaken by the following 
groups (in addition to overall): 


Large public authorities 
Small public authorities 
Large private organisations 
Small private organisations 


e Large public authorities 
e Small public authorities 


A precise definition of large/small, public and private can be found in the 
appendix aswell asthe breakdown of the two samples by type. 
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6.0 Results 
6.1 Data Protection Act 


6.1.1 Awareness of DPA obligations (Unprompted) 


Q18: What obligations are you aware of that organisations have to comply with when 
processing personal information? 


Private 
O La eee a E 
sman | Total | targe | sman | Toe | 
apemon | rn [ oon | me [ron | 7m | ae | 7e 
secure 
ae rai [are | 35% [ a [ a | ae 
processed for limited purposes 
Personal information is not kept 28% 38% 29% 21% 25% 32% 
forlongerthan necessary 
The ICO has identified the same three key indicator obligations that 
organisations have to comply with when processing personal information as 
last year and awareness of all three obligations has increased since 2010. 


Awareness of these obligations has now risen to the levels that were achieved 
in 2007. 


Almost three quarters (72%) of all organisations spontaneously mentioned 
their obligation to keep personal information secure; a significant increase of 
18% from last year. Awareness around processing personal information for 
limited purposes and not keeping foris longer than necessary have increased 
by 5%and 8%respectively. 


This heightened awareness of the obligation to keep personal information 
secure has been driven by the private sector as 75% (52% in 2010) of large 
companies and 73% (46% in 2010) of small companies all mentioned this 
responsbility. 


The increased awareness of the obligations to process information for limited 
purposes and to keep for no longer than is necessary is mainly driven by a 
significant increase within private sector organisations (both large and small). 


Around a fifth (21%) of respondents identified the three key principles shown 
in the table above, an increase of 9%since 2010. 
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Q18: What obligations are you aware of that organisations have to comply with when processing 
personal information? 1 


Obligations 


(Unprompted) 2011 


Personal information is kept secure 


Personal information is processed for 
limited purposes 


Personal information is not kept longer 30% 25% 22% 24% 32% 
than necessary 


33% 


Personal infomation is kept accurate 


O, 
and up to date 30% 46% 


53% 36% 28% 
Personal infomation is processed in a 


O, 
fairand lawful manner 28% 45% 


53% 40% 30% 
Personal infomation held is 32% 19% 18% 


(0) 
adequate, relevant and not excessive 1 23A 


Personal infomation is processed in 


O, O, 
line with the individual rights ae ae 


31% 16% 15% 
Personal information is not transfered 
to other countries without adequate 29% 21% 19% 
protection 


17% 23% 


Awareness of all obligations has increased since 2010, most significantly that 
personal information must be kept secure (+18%) and must be processed ina 
fairand lawful manner (+17%). 


The three key indicators have again featured in the top five most frequently 
mentioned obligations, although following a similar pattem the obligations to 
keep personal information accurate and up to date (46%) and ensuring it is 
processed in a fair a lawful manner (45%) are mentioned the second and 
third most often. 


' Following qualitative consultation with organisations in both the public and private 
sector, the wording of this question were changed in 2010. The word ‘principles’ was 
replaced by ‘obligations’ to ensure a better understanding of the question by the 
respondent. 
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Q18: What obligations are you aware of that organisations have to comply with when processing 
personal information? 


Obligations Public 
(Unpompted zr zae] zeza 2007 | 208 | 2000 [z010 | 200 
Personal information is kept secure 64% 7% 
Personal information is processed for | 355, |Ian oa 19% 50% | 34% | 32% | 44% 37% 
limited purposes | 
Pea nail mro moi onoi eg 27% | 16% | 10% | 8% | 25% | 52% | 34% | 32% | 40% | 38% 
longerthan necessary | 
PARONA linoa lone ape 40% | 25% | 18% | 11% | 37% | 66% | 47% | 38% | 49% | 54% 
accurate and up to date 
Personal information isprocessed in | 44% | 24% | 18% | 7% | 26% [| 62% | 56% | 42% | 50% | 63% 
a fairand lawful manner 
Personal infomation held is 
adequate, relevantand not 23% | 13% | 8% | 6% | 19% | 42% | 26% | 27% | 24% | 31% 
excessive 


Personal information is processed in | 23% | 9% | 5% | 6% | 21% | 39% | 23% | 25% | 28% | 28% 
line with the individual rights 


Personal infomation is not 
transferred to other countries 17% | 11%} 7% | 5% | 20% | 41% 
without adequate protection 


The private sector has been the catalyst forthe overall increasesin awareness 
of all obligations; whereas on average, the public sector awareness levels 
have remained fairly static. 


31% 


30% | 30% | 27% 
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Chart 1: Awareness of all obligations, by sector and size of 
organisation 


24% 


Large Small Large Small 


Public 


Public Private 


Overall Private 


In total 17% of all organisations mentioned all eight obligations spontaneously, 
compared with 14% in 2010. As with previous years there were lower levels of 
awareness of all obligations in the private sector (14%) when compared with 
the public sector (20%). 


Within both the public and private sector, there was higher awareness within 
large organisations, as 24% of large public sector organisations and 19% of 
large private sector organisations were able to identify all eight obligations. 


Number of obligations organisations are aware of 


2011 


z% 
20% 
1a 
2 
2 
2 
m 
176 


Since 2010 there has been a 13% decrease in the number of organisations 
which were able to identify one obligation. 
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6.1.2 Awareness of DPA obligations (Prompted) 


Q19: Which of the following obligations do you think organisations have to comply 
with when processing personal information? Please state which you believe to be 
true and which you believe to be false. 


a o Piae | Public 
Obligations (Prompted) Overall 
Svali | Total | Large | Small | otal 


ap 100% Py oo 
Personal information is 

processed for limited 97% | 95% | 96% | 97% | 97% | 97% | 97% 
pumposes 

Personal information is not 

kept forlongerthan 98% | 94% | 96% | 100%) 97% | 99% | 97% 
necessary 


Once again there was high awareness for the three key indicator obligations 
in both the public and private sector, with all organisations acknowledging 
the fact that they have an obligation to keep personal information secure, 
thishasbeen at 100% for the last five years now. 


Prompted awareness of the obligation to ensure personal information is not 
kept for longer than is necessary has decreased by 1%since last year to 97% 
and awareness of the requirement to only process data fora limited pumpose 
hasremained static at 97%. 
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Q19: Which of the following obligations do you think organisations have to comply with when processing 
personal information? Please state which you believe to be tue and which you believe to be false.2 


By ait Overall 
Obligations (Prompted) 


2007 | æ% | æ% | %0 | m 
Personal infomation is kept secure 100% 100% 100% 100% 100% 
papa ne 7 
aeren S Z 
Personal infomation is processed in 3 
a fairand lawful manner 100% ADOR 100% 1e 
Personal infomation held is 
adequate, relevantand not 97% 98% 98% 99% 99% 
excessive 
Personal infomation is processed in ö 
Personal infomation is not 
transferred to other countries without 98% 97% 95% 97% 96% 
adequate protection 


Awareness of all obligations is very high and it is obvious that when prompted 
organisations are familiar with their obligations with regards to individuals’ 
personal information. This positive message hasremained consistent since this 
question was first asked in 2007. 


2 Following qualitative consultation with organisations in both the public and private sector, the wording of 
this question was changed in 2010. The word ‘principles’ was replaced by ‘obligations to ensure a better 
understa nding of the question by the respondent. 
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Q19: Which of the following obligations do you think organisations have to comply with when processing 
personal information? Please state which you believe to be tue and which you believe to be false.? 


99% | 100% | 100% | 100% | 100% | 100% 


Public 
100% 100% | 100% | 100% | 100% same 
97% 100% | 100% | 100% | 100% | 100% | 99% 


Obligations (Prompted) 
2011 


Personal information is kept 
secure 


100% | 100% 100% | 100% 


Personal information is 


O, 
processed for limited purposes 99% | 97% 


97% | 93% 


sR 


3] 3|s [ais pae 


Personal information is not kept 


O, 
longerthan necessary 99% | 99% 


95% | 92% 
Personal infomation is 
processed in a fairand lawful 100% 
manner 


99% 100% | 100% 


Personal infomation is kept 


O, 
accurate and up to date 100% 


98% 
Personal infomation held is 
adequate, relevantand not 98% 
excessive 


98% 100% | 98% 


There is little variance with awareness levels when comparing the public and 
private sector when prompted. 


Personal infomation is 
processed in line with individual 98% 
rights 


97% 97% | 97% 


Personal infomation is not 
transferred to other countries 98% 
without adequate protection 


96% 98% | 96% 


jejajaji. 
HEHHEHE E 


3 Following qualitative consultation with organisations in both the public and private sector, the wording of 
this question was changed in 2010. The word ‘principles’ was replaced by ‘obligations to ensure a better 
understa nding of the question by the respondent. 
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6.1.3 Awareness of individuals’ rights (Unprompted) 


Chart 2: Unprompted awareness of the right to see information 


R? = 0.6623 


2007 2008 2009 2010 2011 


—e— The right to see information Trend Line 


Spontaneous awareness of individuals’ nghts has decreased slightly since 
2010 (-4%), however it is the second highest level of awareness (85%) since 
2007. 


Unlike last year, awareness within the public sector (94%) was higher than the 
private sector (76%). Large public sector organisations proved to be the most 
knowledgeable (97%), and additionally almost nine out of every ten 
small/medium public sector organisations identified this right soontaneously 
(89%). 


Just over fourfifths of large private organisations (82%) mentioned the 


individual's right to see information, whereas 70% of small organisations 
mentioned this unprompted. 
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Q16: What rights are you aware of thatare given to individuals about whom your organisation processes 
personal information? 


Overall 
The right to see information 82% 89% 85% 


The right to corect inaccurate 33% 14% 25% 
information 


The right to prevent the processing 


of information if it would cause 24% 9% 12% 10% 13% 
damage ordistress 

The right to object to decisions 15% 8% 6% 3% 7% 
made only by automatic means 


Individuals Rights (Unprompted) 
2011 


The right to stop unsolicited mail 17% 3% 7% 


The right to claim compensation for 

damage or distress caused bya 13% 6% 5% 5% 6% 
breach ofthe Act 

The right to have the breach ofthe ò ö E ð 6 
Act investigated and assessed 12% SA an ais 
Individuals have no rights 0.4% 0% 0.1% 


Encouragingly, with the exception of the right to see information, awareness 
of all other rights has increased, with awareness of the individual's right to 
correct inaccurate information increasing by 11% since 2010, moreover, this is 
the highest this right has been since 2007. 
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Q16: What rights are you aware of that are given to individuals about whom your organisation processes 


Individua 


The right to 


The right to 
information 


SEE information? 


Public 
Is’ Rights (Unprompted) 
o | a0 
see information 72% 67% | 93% | 76% | 92% 76% | 84% 


2% | 17% 27% 


N 
þa 


correct inaccurate 18% 7% 48% 30% 


The right to prevent the processing 

of information if it would cause 14% | 5% 3% 1% 7% | 33% | 14% | 20% | 19% 
damage or distress 

The right to object to decisions 10% | 4% 2% 1% 20% | 11% | 10% 

made only by automatic means 

The right to stop unsolicited mail 10% | 1% | 24% | 6% 


The right to 


breach of the Act 


damage ordistresscaused bya 6% 1% 


The right to 
Act investig 


Individuals have no rights 


Don’t know 


claim compensation for 
9% 


1% | 4% | 20% 9% 
3% | 17% 6% 


m KA 


Awareness of all rights was higher among respondents from the public sector, 
with significant differences in awareness that individuals have the right to see 
information (18% greater than the private sector), the right to comect 
inaccurate information (16% greater than the private sector) and the right to 
prevent processing if it would cause damage or distress (11% greater than the 
private sector). 


have the breach of the 
ated and assessed 
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2011 
94% 


33% 


18% 


9% 


8% 


8% 


6% 


0% 
3% 


6.1.4 Awareness of individuals’ rights (Prompted) 


Chart 3: Prompted awareness of the right to see information 


R? = 0.6758 


2007 2008 2009 2010 2011 


—e— The right to see information about them Trend Line 


On a prompted level, 97% of all organisations were aware that individuals 
have the right to see information held about them. Between 2007 and 2011 
awareness has been consistently high, with variances between 97% and 99% 
during this period. 
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Q17: I am now going to read outa list of rights which may or may not be given to individuals about whom 
your organisation processes personal information. Please tell me which you believe to be tue and which 
you believe to be false. 


Overall 


94% 95% 96% 
95% 95% 95% 


88% 91% 87% 


87% 88% 87% 


Prompted awareness of all rights is still very high and all have remained fairly 
consistent since 2007. There is still a lower level of awareness around the 
individual's right to object to decisions made only by automatic means and 
this has decreased slightly (-3%) since 2010; however seven out of every ten 
organisations recognised this asa right when prompted (71%). 


Individuals’ Rights (Prompted) 


Ke] 


The right to see infomation 9% 


The right to comect inaccurate 
information 


The right to have the breach of the 
Act investigated and assessed 


95% 


95% 


The right to stop unsolicited mail 92% 


The right to claim compensation for 
damage ordistresscaused bya 89% 
breach of the Act 


The right to prevent the processing 
of information if it would cause 85% 
damage or distress 


The right to object to decisions 


o, 
made only by automatic means Ae 


ho 


Individuals have no rights 1% 
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Q17: I am now going to read outa list of rights which may or may not be given to individuals about whom 
your organisation processes personal information. Please tell me which you believe to be tue and which you 
believe to be false. 


Private Public 
Individuals’ Rights (Prompted) 
207 2011 | 2007 | 2006 | 200 | z010] 2008 
The right to see information 99% | 98% | 97% 99% | 99% 98% | 98% 


The right to corect inaccurate 
information 


The right to have the breach of the 
Act investigated and assessed 


94% | 94% 


94% 94% 


88% 88% | 92% 


88% 86% | 87% 


95% 96% | 97% 
95% 99% | 97% 


87% 92% | 86% 


= 
92% | 
[eins 
1% | 


94% | 95% 


The right to stop unsolicited mail 91% | 89% 


The right to claim compensation for 
damage ordistresscaused bya 92% 
breach of the Act 


88% 


The right to prevent the processing 
of information if it would cause 84% 
damage ordistress 


72% 


72% 86% | 85% 82% | 86% 
64% 77% | 74% 77% | 75% 


2% | 7% | 1% | 1% | 2% | 2% | 1% | 1% 


The right to object to decisions 


O, 
made only by automatic means an 


62% 


Individuals have no rights 2% 2% 


© 
2 
zD 


With the exception of awareness around preventing the processing of 
information if it were to cause damage or distress and the right to object to 
automated decisions, there is little vanance between the knowledge levels of 
the public and private sector. Both sectors continue to have high levels of 
prompted awareness of data protection rights forthe individual. 
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6.1.5 Source of advice on the DPA 


Chart 4: Where to go to get advice on responsibilities regarding the DPA? 


5 27% 
20% 23% 26% 27% 
21% 
10% 
3% 
1% 
0% _ —- : nan O UOU 
“3007 8 2069 2010 2011 
—e |CO [Any) —e— |CO (Website) —e— |CO (Telephone) —e— ICO (Other) 


The overall percentage of respondents mentioning the ICO as their main 
source of advice on the DPA has increased by more than a tenth (12%) since 
2010. 


Q20: Where would you go to get advice on your responsibilities regarding the DPA? (Unprompted) 


Overall 
w | z% | æ | mo | 
Soler 17% 
ICO fothermeans) 3% 


The increas in the ICO has been largely influenced by the frequency which 
the ICO’s website was mentioned. The ICO website has consistently emerged 
asthe most prefered source for advice over the last five years. In 2011 there 
has been a 14% increase in mentioning the website, consequently, the 
difference between this and other sources is larger than it ever has been. 
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Q20: Where would you go to get advice on your responsibilities regarding the DPA? (Unprompted) 


2011 


2009 | 
80% | 81% 


ICO Any 40% 


2007 | 2006 2008 | 2009 | 2010 
40% | 41% 80% | 
ICO Weste 36% | 37% | 25% | 15% | se% | 60% | s0% | ore | OTH | 73% 
ICO Phone ime | 15% | an | 5% | sam | 6% | 35% | aim | 37% | ame 
Soictor 26% | 20% | 17% | 14% | are | 19% | 9% | 13% | 19% | ama 
Head office 8% 
Govemment Dept. 3% 
1% | EJEA 
4% | 2% | 2% | 1% | 1% 


n [am | oe 
ma | on |an | mm | im | m | am | mm | om 


The frequency in which private sector organisations mentioned the ICO, 
whether it be by website, telephone or other means, has increased by almost 
a quarter (23%) since 2010. In the public sector the level which the ICO was 
mentioned has remained consistent with 2010 (although there has been an 
increase of 6%forthose mentioning the ICO website). 


ICO (other means) 1% 
CAB 4% 
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6.1.6 Knowledge of organisations responsible for enforcing the DPA 


Chart 5: Awareness of the ICO as the enforcer of the DPA 


2007 2008 2009 2010 2011 


—— Overall ——Public —e—Private Trend Line 


Seven out of ten organisations (70%) said they were aware of the ICO and its 
responsibilities for DPA and although this is just 1% higher than awareness 
levels in 2007, it represents an increase of 16%since 2010. 
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Q21: Which organisations are you aware of thatare responsible for enforcing the DPA? 
Overall 
20068 | 2009 | 
ICO 69% 54% 
Govemment 4% 7% 
Ministry of J ustice 2% 3% 
Data Protection Agency 2% 5% 
Data Protection Registrar / Commissioner 3% 1% 


Office forthe Scottish Information io 186 
Commissioner 

Department for Constitutional Affa irs 1% 0% 
Don’t know 21% 19% 27% 


The ICO continues to be the organisation that is most recognised as having 
responsibility for the DPA. Less than 10% mentioned the Govemment (7%) 
which remains consistent with the previous two years. 


Response (Unprompted) 


Q21: Which organisations are you aware of thatare responsible for enforcing the DPA? 


Public 
ICOs 54% 
Govemment 6% 
Ministry of J ustice 1% 


ae Protection 3%, 
gency 


5 
B 


Response 
(Unprompted) 


Ww 


6% 20 


7% 6% 2% 


x 
g 
xX 
œ% 
B 
zD 
œ 
& 
p 
oo 
Q 
zD 


Office forthe Scottish 
Infomation 1% 1% 0% 
Commissioner 


None 3% 3% 5% 


Don’t know 33% 


Public sector awareness has remained fairy consistent over the last five years, 
with a 1% increase since 2010, and awareness regarding the responsbility of 
enforcing the DPA amongst public sector organisations (88%) is still much 
higher than those organisations in the private sector (53%). Despite this 


a 


46% | 29% | 10% 8% 


S 
xS 


4Combined Infomation Commissioner s Office, Information Commissioner and ICO responses 
5 Combined Infomation Commissioner s Office, Information Commissioner and ICO responses 


_2007 2009 | 2010 
54% | 84% 80% | 87% 
EA AAEE 
EA n | se | se | 5m | 
E a [ae 
Data Protection 
Eo A 
Commissioner 
Aa e 
ES 5% 1% | 4% 
33% | 10% | a% | s% | 7% 


2011 
70% 
7% 
6% 
4% 
2% 
1% 
0% 
1% 
17% 


2011 
88% 
3% 
10% 


1% 


1% 


1% 
5% 


awareness among private sector organisations has increased by 33% since its 
lowest point in 2010 meaning awareness in this sector is similar to what was 
found in 2007. 


The private sector are more likely to suggest it is the Govemment that are 
responsible for the DPA (12% compared to 3%of the public sector) and were 
far more likely to answer don’t know to this question (29% compared to 5% in 
the public sector). 


Q21: Which organisations are you aware of thatare responsible for enforcing the DPA? 


Response (Unprompted) 


Govemment 2% 


Data protection Registrar 
/ Commissioner 


Data Protection Agency 


7% 


Ministry of J ustice 
Office forthe Scottish 
Information 
Commissioner 


1% 


Don’t know 10% 


The impact of the organisational size on awareness of the ICO as enforcer is 
highlighted in the table above and it is perhaps no surprise that it is the small 
private sector organisations in particular which have the lowest levels of 
awareness (38%). Large public sector organisations are much more likely to 
be aware of the ICO asthe enforcer of the DPA than large private sectorand 
small public organisations. However, large and small private sector awareness 
of the ICO asthe enforcing organisation have significantly increased in 2011 
(+43% large private: +21% small private). 


ê Combined Information Commissioner's Office, Information Commissioner and ICO responses 
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6.1.7 Notification 


Q22: I am now going to read out four statements about notification. Please tell me which you believe to be 
true and which you believe to be false. 


Overall 


zor | we [2000 | 0 | am 


Notification is usually a legal ô ò ò b 

requirement as part of the DPA H ii eee ain 
Those organisations that do not have to 

notify still have to comply with the 85% 89% 87% 79% 86% 
principles of the DPA 


Some orga nisations may be exempt 66% 61% 58% 52% 58% 
from having to notify 


After the drop in awareness conceming notification in 2010, understanding in 
this area has now reverted back to what was a fairly consistent and positive 
level of knowledge. Almost nine out of ten organisations (87%) agreed that 
notific ation is usually a legal requirement as part of the DPA and just less than 
this (86%) believe that those that do not have to notify do still have to comply 
with the DPA principles. 


Statements (Prompted) 


Q22: I am now going to read out four statements about notification. Please tell me which you believe to be true 
and which you believe to be false. 


Private 


85% 80% | 60% | 81% | 92% | 91% | 90% | 92% | 93% 


Statements (Prompted) 


Notific ation is usually a legal 
requirement as part of the DPA 
Those organisations that do not 
have to notify still have to 


comply with the principles of the 
DPA 


Organisationscan notify 72% | 71% | 75% | 70% 
volunta nily 

some organeabonaimay pe 65% | 49% | 49% | 36% | 46% | 66% | 73% | 67% | 68% | 70% 
exempt from having to notify 


Levels of awareness for all four statements have increased within the private 
sector, however levels of agreement from public sector organisations has 
either remained relatively static or decreased slightly, although they are still 
very positive findings. 


87% 
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6.1.8 Implications of the DPA 


Q23: To what extent would you agree or disagree with the following statements about the DPA?7 
Data Protection Act Overall 


Saas 201 
It improves customers’ trust 84% 83% 90% 


management 
management 


It addsvalue to the business 63% 68% 70% 


organisation 


Itisa waste of resources 7% 9% 5% 


Appreciation and perceived value of the DPA in an organisational context is 
gill very high and continues to grow as time passes. The vast majority of all 
organisations (95%) are in agreement that the DPA is needed, 90% believe it 
improves customer's tust and 90% agree that it has a postive effect on an 
organisation’s infomation management. All of these opinions have increased 
since 2010, including a +8% shift on the positive impact the Act has on 
customer's trust. 


Fewer organisations now believe the Act means extra work (62% compared 
to 66% in 2010) and just 5% consider the DPA to be a waste of resources (a 4% 
decrease from last year). 


7 This percentage of agreement refers to the respondents that stated ‘agree’ or ‘strongly 
agree’ to the statements. 
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Q23: To what extent would you agree or disagree with the following statements about the DPA?® 


Data Protection Act Private Public 
Statement (Prompted) | 2007 | 2008 | 2009 | 2010 | 2011 | 2007 | 2008 | 2009 | 2010 
management 
management 
organisation 
tisa waste ofresources | 10% | 3% | m | 12% | an | me | ae | am | o% 


For the fifth consecutive year, public sector organisations were more likely 
than private sector organisations to agree with the positive statements; 
although it is this sector that are more likely to suggest the Act means extra 
work (private: 59%, public: 66%), and that it is a burden on the organisation 
(private: 15%, public: 18%). 


As stated in previous reports it is worth noting that the measure of extra work is 
one of fact rather than emotional opinion, and not necessarily a “negative” 
measure. Instead, it may be a perception that the organisation is taking the 
matter of data protection seriously, especially as just 18% have suggested the 
DPA isa burden on the organisation. 


8 This percentage of agreement refers to the respondents that stated ‘agree’ or ‘strongly 
agree’ to the statements. 
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6.1.9 Requests for personal information (subject access requests) 


Q24: Approximately how many requests for personal information has your organisation 


received in the past 12 months? 


Overall 
Number of requests 
None 29% 
jut 12 12% 
500% T4 


Overall, there has been a general increase in the volume of requests that 
organisations have dealt with in the last 12 months. Far fewer private sector 
organisations (45%) say they have received no subject access requests over 
the past 12 months; this is the lowest recorded figure for this sector and an 
18% decrease from 2010. Public sector organisations show an even higher 
level of nil activity with just 14% that said they had received no requests in the 
last 12 months which again is the lowest recorded figure for this sector and is 
a 2%decrease from last year. 


33 


Q24: Approximately how many requests for personal information has your organisation received in the 


past 12 months? 
Number of requests nwa hota 
"2007 | 2008 | 2000 [ 2010 | z011 | 2007 | 2008 | 2000 | 2030 
None 52% | 63% | 45% | 24% | 21% | 20% | 16% 
jus 12 
3-10 19% | 16% | 11% 18% | 21% 
50% z 


Large public organisations remain the sector that is most likely to receive a 
high volume of requests; 38% say they have received more than 50 requests in 
the last year (although this is 3% less than last yean); in addition 25% of small- 


medium organisations in the public sector had received more than 50 
requests. 


Smaller private organisations are perhaps unsurprisingly, more likely to have 
received no or few requests. 
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2011 
14% 
9% 
23% 
21% 
10% 
8% 
4% 

10% 


Chart 6: The number of requests for information under the 
DPA compared with the previous year, by sector 


More Less Stayed the same 


mPrivate mPublic m Overall 


When asked how this compared to the previous year, over a fifth (21%) of all 
respondents said they had seen an increase in the number of requests 
(consistent with 2010); 5% said it was less and 72% felt it was about the same. 
This was a very similar picture to both 2009 and 2010, with just a 2% increase 
on those that said they had received more requests. Again it is the public 
sector that suggests the largest increase at 29% compared to 13% within the 
private sector. 


Q25: The amount of requests for personal information under the DPA compared to 2007 


ee 
2007 2008|2005| 201021 2007 20062000201) 0132007] 200 ooo] znd 2003 
ae 107a] 0 | 9e [337 on | 21%] 27 319| are] 13| 16% 106] 30% 
ra 3% | 496) 3% | a [a6] 9% | | 7% | sr | ae | 7 | sv] 5 
7874| 8674| a | 387a a a5] 7024| aoe] 324| Tl 76% 7% 


The level of increased activity with regards to requests for personal 
information has become more consistent over the last three years both 
overall and in the public sector. However, the private sector, albeit a lower 
figure in comparison to the public sectorhasincreased by 5%since 2010. 


Number of requests 


About the same 
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6.2 Freedom of Information Act 


6.2.1 Knowledge of FOIA obligations 


Q28: What obligations are you aware of that apply to public authorities under the FOIA?7 


eee : Overall - 
Obligations (Unprompted) Small/Medium tage Public Sector 
Public authorities must provide help and advice 32% 47% 40% 
to people asking for infomation 
Public authorities must disclose information unless 27% 33% 30% 
there isa legal reason not to 


Four in ten respondents (40%) were aware of their obligation to provide help 
and advice to people asking for information, while three in ten (30%) knew 
they must disclose information unless a legal reason did not permit them to do 
so. Awareness of the two key indicators, identified by the ICO, was low 
compared with awareness of other obligations, particulary among 
sma ll/ medium authorities. 


Q28: What obligations are you aware of that apply to public authorities under the FOIA?2 


Obligations (Unprompted) 2011 
Public authorities must provide help and 5 4 a 
advice to people asking for information oT ove Aan ao 
Public authorities must disclose information 52% 30% 31% 24% 30% 
unless there isa legal reason not to 
Public authorities must respond to requests 
made under the general rights of access 67% 55% 56% 58% 68% 
within 20 working days 
Public authorities must provide information 63% 49% 39% 49% 58% 
through a publication scheme 


Almost seven tenths (68%) of respondents were aware of their obligation to 
respond to requests within 20 working days, and six tenths (58%) knew that 
information must be provided through a publication scheme. 


Awareness of all obligations is higher than in 2010, with increases of around a 
tenth that public authorities are obliged to provide help and advice to 
people asking for information (+11%), must respond to information requests 
within 20 working days (+10%) and that information must be provided through 
a publication scheme (+9%). 


Following qualitative consultation with public authorities, the wording of this question was changed in 
2010. The word’ legal’ was removed so that it read “what obligations....” as opposed to “what legal 
obligations...” to ensure a better understanding of the question by the respondent. 
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Public authorities must provide help and advice 32% 


Q28: What obligations are you aware of that apply to public authorities under the FOIA?7 
Overall - 


Obligations (Unprompted) Small/Medium Public Sector 


47% 40% 


to people asking for information 


there isa legal reason not to 


Public authorities must respond to requests made 


under the general rights of access within 20 61% 


73% 68% 


working days 


Public authorities must provide information 48% 


Public authorities must disclose information unless 30% 


66% 58% 


through a publication scheme 


Awareness of all obligations was higher within large public authorities when 
compared with small/medium authorities; particulary having to provide 
information through a publication scheme (large 66%, small/medium 48%) 
and providing help and advice to people asking for information (large 47%, 
sma ll/ medium 32%). 


Q29: Which of the following obligations under the FOIA do you believe to be tue or false? 1° 


Obligations (Prompted) 2008 2009 | 2010 | 2011 


Public authorities must provide help 
and advice to people asking for 99% 97% 98% 98% 97% 


information 


Public authorities must disclose 
information unless there isa legal 97% 98% 99% 99% 97% 


reason not to 
Public authorities must respond to 


Public authorities must provide 
information through a publication 95% 95% 97% 95% 94% 


scheme 


requests made under the general 96% 96% 97% 98% 97% 
rights of access within 20 working 
days 


As in all previous years, with prompt there were extremely high levels of 
awareness of all obligations. 


Similar to 2010, awareness was slightly lower that infomation must be 
provided through a publication scheme, however, the majority of 
respondents were aware ofthis obligation (94%). 


S Following qualitative consultation with public authorities, the wording of this question was changed in 
2010. The word’ legal’ was removed so that it read “what obligations....” as opposed to “what legal 
obligations...” to ensure a better understanding of the question by the respondent. 
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Q29: Which of the following obligations under the FOIA do you believe to be tue or false?® 


fas gs = Overall - 

Obligations (Prompted) Small/Medium tage | Public Sector 
Public authorities must provide help and advice 94% 99% 97% 
to people asking for information 
Public authorities must disclose information unless 95% 99% 97% 
there isa legal reason not to 
Public authonties must respond to requests made 
under the general rights of access within 20 93% 100% 97% 
working days 
Public authorities must provide infomation 89% 97% 94% 
through a publication sheme 


As with unprompted awareness, for all obligations large public authorities 
demonstrated higher prompted awareness than small/medium organisations 
(with differences ranging from +4% to +8%). However, regardless of these 
comparisons, awareness among small/medium authorities was high (89% and 
above) forall obligations. 


6.2.2 Awareness of public’s rights (Unprompted) 


Chart 7: Unprompted awareness of the right to request 
information held by the Government and other public authorities 


`O 


`O 
—~ N Q 


92% 
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2007 2008 2009 2010 2011 


—e— The right to request information held by the Government and other public authorities 


Trend Line 


Spontaneous awareness of the public’s right to request information is now 
91%, meaning there hasbeen an increase of 2%since 2010. 
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Although awareness was higher in large public authorities (96%), the overall 
increase in awareness has been driven by the small/medium authonities (85%) 
where there hasbeen an increase of 6%since 2010. 
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Q26: What rights are you aware of that the FOIA gives to the public? 


son oo | om | om | me | 
(Unprompted) 


The right to request information held by the Govemment 
and other public authorities 


The right to know what type of information is available 
from the Govemment and other public authorities 


The right to see official information from the Govemment 


Following decreases in awareness between 2009 and 2010, awareness of 
each right has increased between 2010 and 2011. The most significant 
increases were in regards to the right to see official information (+8%), the 
right to know what type of information is available (+7%) and the right to see 
what public money is being spent on (+7%). Awareness was lower that 
individuals possess the right to request information about the environment 


(6%). 
Chart 8: Prompted awareness of the right to request information held 
by the Government and other public authorities 
100% 
100% 
100% 
100% 


2007 2008 2009 2010 2011 


—e The right to request information held by the Government and other public authorities 


Trend Line 


Asin all previous years, when prompted the vast majority of respondents were 
aware of the public’s right to request information (99%). 
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and other public authorities such as minutes and 21% 5% 11% 3% 
planning documents 


The right to see what public money is being spent on 16% 
The right to request information about the environment 14% 
The public don’t have any rights 1% 
Don’t know 4% 


91% 


17% 


11% 


Q27: | am now going to read outa list of rights that may or may not be given to the public under the 
FOIA. Please tell me which you believe to be tue and which you believe to be false. 
Public Rights 
(Prompted) 
The right to request information held by 
the Govemment and other public 99% 
authorities 


The right to see what public money is 100% 99%, 
being spent on ° i 


207 | 2 | 2000 | 200 
The right to know what type of infomation 
is available from the Govemment and 98% 97% 98% 98% 98% 
other public authorities 


The right to see official information from 
the Govemment and other public 
authorities such as minutes and planning 
documents 


93% 95% 


The right to request information about the 
environment 


The public don’t have any rights 2% 


There isa large difference between unprompted and prompted awareness, 
and for almost all of the rights when given prompt, awareness was 95% or 
more. Despite this the knowledge that the public has the right to request 
environmental information is still lower than all other freedom of information 
rights (83%). 


There has been little variance in awareness of most rights since 2010, however 


knowledge that the public has the right to request information about the 
environment has decreased by 4%since 2010. 
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6.2.3 Source of advice on the FOIA 


Q30: Where do you tum to for advice on the FOIA? 

Source of Advice (Unprompted) = 2007 | 2008 | 2009 | 2010 — 
ICO Overall 66% 77% 
ICO (by telephone) 
inhouse expert 
Solicitor / legal department 
ICO (not website ortelephone) 
Person responsible for freedom of infomation overall 
Office of the Scottish Information Commissioner 
Campaign for freedom of information 


The vast majority of respondents indicated that they would tum to the ICO for 
advice on the FOIA. In particular the ICO website has emerged as the 
preferred method of seeking advice. 


In 2011, there was less reliance on an ‘in-house expert’ to provide advice on 
the FOIA (18%, -7% from 2010), however, there has been a slight increase in 
those who would seek advice from a solicitor or legal department (16%, +3% 
from 2010). 


1 ICO’ combines responses of Information Commissioner s Office, Information Commissioner and ICO 
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2011 
79% 
71% 
32% 
18% 
16% 
6% 
5% 
1% 
4% 
0% 
16% 


Q30: Where do you tum to for advice on the FOIA? 2 


Source of Advice (Unprompted) large | Small 
ICO Overall 86% 70% 
ICO website 64% 
ICO (by telephone) 25% 
In-house expert 18% 
Solicitor/ legal department 16% 
Ministry of J ustice 3% 
Person responsible for freedom of information overall 2% 
ICO (not website ortelephone) 2% 
Office of the Scottish Information Office 3% 
Campaign for freedom of information 0% 
Other 19% 


It was the respondents from larger public authorities who more frequently said 
they would seek advice from the ICO, whether it be by telephone, intemet or 
through other mediums (86%). Although smaller authorities mentioned the 
ICO less frequently, it was still the preferred source of advice for seven out of 


ten of this size authority (70%). 


12 CO’ combines responses of Information Commissioner's Office, Information Commissioner and ICO 
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6.2.4 Organisations responsible for enforcing the FOIA 


Q31: Which organisations are you aware of thatare responsible for enforcing the FOIA?13 


Organisations (Unprompted) | 2007 | 2009 | 2011 
ICO 84% | 80% 84% | 86% 
Ministry of J ustice 1% 10% 
Office forthe Scottish Information Commissioner | 5% 6% 
Govemment 4% 5% 
Data Protection Agency 1% 
Department for Constitutional Affa irs 2% 0% 


Data Protection Registrar / Commissioner - 0.2% 0.3% 0% 


86% of respondents were aware of the ICO’s responsibility for enforcing the 
FOIA; an increase of 2% since 2010 and 6% since 2008. A further 6% identified 
the Office forthe Scottish Information Commissioner asthe enforcer. 


There was however, still some confusion as 10% of respondents 
acknowledged the Ministry of Justice, an issue particulary influenced by 
larger public authorities (14% large, 5% small/medium). 


Similar to the DPA, 14% of small/medium public authorities did not know which 
organisation enforced the FOIA. 


13 CO’ combines responses of Information Commissioner's Office, Information Commissioner and ICO 
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6.2.5 Implications of the FOIA 


Q32: To what extent would you agree or disagree with the following statements about the FOIA? 


ee Overall 
Implication (Prompted) 


2000 | z010 
It improves records management 
It increases trust 
It means extra work 
It improves organisational knowledge exte mally 
It improves organisational knowledge intemally 
It increases participation 
It puts strain on resources 
It hasincreased expenditure 

34% | 37% | a% _| 


It isa burden on my organisation 34% 37% 49% 
Every year, agreement has been highest that the FOIA is needed and 
improves record management, and the trend has continued in 2011 (with 
84% of respondents agreeing with each statement). The FOIA was also 
considered to increase trust (81%), for which agreement has increased by 
11% since 2010. 


For the four statements that could be considered to be negative, agreement 


has decreased since 2010, particulary that the FOIA has increased 
expenditure (59%, 7% decrease from 2010). 
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2011 
84% 
84% 
81% 
80% 
80% 
73% 
73% 
64% 
59% 
45% 


Q32: To what extent would you agree or disagree with the following statements about the FOIA? 
Small/Medium Large 


Implication (Prompted) 


|2007 | 2008 | 2009 | 2010 | 2011 | 2007 | 2008 | 2009 | 2010 
management 
It improves organisational 72% | 82% | 75% | 69% | 76% | 83% | 83% | 85% | 85% 
knowledge extemally 
It improves organisational 66% | 76% | 70% | 68% | 70% | 78% | 74% | 76% | 80% 
knowledge intemally 
It hasincreased expenditure 59% 51% | 57% | 61% | 65% | 71% 
organisation 


Although both large and small/medium public authorities expressed high 
levels of agreement to all statements given, the most significant differences 
between the different sized organisations arose from the more negative 
statements. 


Around a fifth more respondents within larger authorities felt the FOIA puts a 
strain on resources (422%), isa burden on their organisation (+21%) and has 
increased expenditure (+14%). 84% of respondents in larger authorities also 
said the FOIA means extra work within their organisation; 8% more than 
respondents within small/medium organisations. 
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2011 
85% 


83% 


79% 
84% 


83% 


75% 


74% 
73% 
65% 


54% 


6.2.6 Information requests 


Q33: Approximately how many requests for information has your organisation received in the past 


12 months under the FOIA? 
Number of requests ee 
None 
jus 2 5% 
50-100 w% 


For the third year in succession the number of respondents saying their 
organisation had received no requests for information in the 12 months prior 
to undertaking the survey has decreased (by 2% since 2010 and 4% since 
2009). This has been driven by small/medium sized public authorities, among 
which the number of respondents saying their organisation had received zero 
requests has almost halved since 2007. 


Since 2010 there has been an increase in the number of organisations 
receiving 200 or more requests for information (+3%), a trend which has arisen 
from large organisations (+5%). 


Q33: Approximately how many requests for information has your organisation received in the past 12 months 


under the FOIA? 
epee large 
2007 | 200s | 2009 | 20m0 | 2011 | 2007 | 2008 | 2000 | 2o10 | zona 
jus m 
200-500 3% 10% | 9% 29% 
T 2 = 


Chart 9: The number of requests for information under the 
FOIA compared with the previous year, by size 


More Less Stayed the same 


aSmall/medium mLarge m Overall 


When asked how this compared to 2010, almost two thirds (63%) of 
respondents said the number of requests represented an increase for their 
organisation. Only 4% of organisations had received fewer requests than the 
previous year. 


More than half (53%) of small/medium authorities had not expenenced any 
changes in the number of requests they had received however, larger 
authorities had experienced more demand with 77% of authorities of this size 
reporting an increase in the number of requests. 


Q36: Compared to last year, is the number of requests made under the FOIA: 


Change in requests 2011 
More 63% 
Less 4% 
About the same 33% 


Each year has seen an increase in the number of authorities saying the 
number of requests they have received is more than the previous year. The 
number of public authorities reporting a rise in the number of requests has 
more than doubled since 2007 (from 26% in 2007 to 63% in 2011), whereas 
those saying the number of requests has not changed has almost halved 
(from 65% in 2007 to 33%in 2011). 
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6.3 Information Commissioner's Office 


6.3.1 Awareness of the ICO 


Q35: Have you ever heard of the Information Commissioner's Office? 


Overall 


2007200 2000 201) on |2007 2008200} uo 202007200] 200] nnn 
ss 5 ave || 697%] ar | | aT 
ana 04] ane] |e | | 36 | [|e 2 


Nine out of ten organisations (90%) were aware of the ICO; the highest level 
of awareness since tracking began and a 12% increase since 2010. 
Awareness within public sector organisations has been consistently high, and 
therefore this increase isa result of a significant increase in awareness among 
private sector organisations (+23%since 2010). 


Awareness 
(Prompted) 


Awareness was greatest among large public authorities, where 99% of 
organisations interviewed had heard of the ICO. Small private organisations 
had the lowest levels of awareness as 24% had not heard of the ICO and a 
further 3% were not sure they had heard of the ICO. 


6.3.2 Advice and guidance from the ICO 


Q36: How would you prefer to receive advice and guidance on the DPA and FOIA from the Information 


Commissioner? 

Method (Unprompted) (2007 | 2008 | 209 | 2010 | 2 
Website amn | 2 | æ | 2% | æ 
Via stand alone email request 37% 
Via email bulletin | register to 23% 
Via letter am | an | 20% | a% | am 
Phone 3% | m | s | m | o 
Via emailthrough a website 8% 
Through a leaflet 3% 
Face to face 2% | x| n| im | x 
F T Pe aaa ns/advice 1% 
Visit office 0.2% 


For the first time since tracking began a website was the prefered method of 
receiving information and guidance about the DPA and FOIA (43%). 
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However, a stand alone email (37%) or an email bulletin (23%) remained 
popular mediums for receiving such information. 


Q36: How would you prefer to receive advice and guidance on the DPA and FOIA from the 
Information Commissioner? 


Method (Unprompted) 


Website 


Via stand alone email request 35% | 42% 36% 


Via email bulletin | register to 17% | 16% 31% | 30% 
Via letter 38% 30% | 27% | 18% 15% | 6% 


L 
& 


Phone am | 3% | 2% | oe | oe | 7m [ar] ox | on [ame 
Via email though a website | 24% | 15% | 5% | 6% | 9% | 38% | 12% | 13% | 16% | 7% 


Get in touch with other 


eats : 2% 0% | 1% | 1% | 6% | 1% | 1% | 1% 
organisations/advice agency 


Visit office 1% | 0.2%] 0% | 0% | 0.3% 0.3% | 0.2% 


The increased popularity for receiving information through a website isa result 
of a 23% increase in public sector organisations selecting this as their 
prefered method of receiving information (60%); as in previous years private 
organisations tended to opt forstand alone email requests (42%). 


38% | 27% | 30% | 
6% | 3% | 2% | 
24% | 15% | 5% | 
Through a leaflet 2% | 3% 
Face to face 1% | 2% 3% 
BAE EJ 
1% | 0.2%) 0% | 


Private sector organisations (18%) had greater preference than public sector 
organisations (6%) for receiving advice and guidance through a letter, while 
those working in public sector organisations tended to opt for information 
through email bulletins oroverthe telephone. 
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6.4 Organisational structure and DPA / FOIA duties 


6.4.1 Other duties 


As in previous years, the vast majority of respondents working in both the 
public (89%) and private (96%) sectors said that they had other duties aside 
from their data protection or, where applicable, freedom of information 
duties. 


6.4.2 Time dedicated to data protection duties 


Q4: Ona weekly basis, what percentage of your time is dedicated to data protection duties? 


Overall 


75 - 99% 3% 4% 3% 2% 5% 


When compared with previous years, fewer respondents spent 10% of their 
time or less on data protection duties (57%). However, only 1% of respondents 
said their responsibilities contributed to all of their working day. 


Time dedicated to data protection 


Unlike 2010, those working within the private sector dedicated less time to 
their data protection duties than those working in the public sector, as 61% 
compared with 53% said their duties took 10% or less of their time. 


Q4: Ona weekly basis, what percentage of your time is dedicated to data protection duties? 
Time dedicated to data Private 


Public 

prmeton > [2007 | 2006 | 2008 | 2010 | 2011 | 2007 | 2008 | 2008 | zozo | 200 
10% or less 73% | 69% 53% 
10 - 25% 10% 18% 20% | 21% 


Chart 10: In the past 12 months, has your data protection 
responsibility... 


Increased Decreased Stayed the same 


mPrivate mPublic m Overall 


Almost a third (31%) of respondents said there had been an increase in their 
data protection duties, whereas only 2% of respondents said there had been 
a decrease in their responsibility. 


The largest portion of respondents said their responsbility had remained the 
same (67%), particulary those working in the private sector (72%). 


Q6: Please specify the reasons why your responsibility has increased. 


Reasons for change Overall 
Increases in DPA requests/ workload 33% 
Improvement in security / increased awareness 29% 
Because of intemal company review / changes 25% 
Because of change in job role 9% 
Changes to law / legislation 8% 
Because we have less resources to deal with it 2% 
More people are dealing with it 1% 
We are sharing data with other countries 1% 
Increased data sharing among councils and its partners 0.4% 


Increases in the responsibility tended to result from increases in DPA requests 
and workload (36%) and improvements in security or increased awareness 
(30%); whereas a decrease in responsbilities was mostly attributed to intemal 
company review/changes (50%). 
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6.4.3 Time dedicated to freedom of information duties 


Q7: Ona week to week basis, what percentage of your time is dedicated to freedom of information 
duties? 


of information 


100% 2% 10% 2% 1% 1% 


There has been an increas in the time spent on FOI duties, as only 42% of 
respondents said that these responsibilities take 10% or less of their time. Similar 
to time spent on DP duties, only 1% of respondents dedicated all of their time 
to FOI duties. 


Chart 11: In the past 12 months, has your freedom of 
information responsibility... 


70% 629 


Increased Decreased Stayed the same 


m Small / Medium mLlarge m Overall 


Respondents were almos equally divided as to whether the time spent on 
their FOI duties had increased (45%) or remained the same (51%) over the 12 
months prior to completing the survey. Similar to DP duties, few respondents 
said there had been a decrease in their responsibilities (4%). 
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Q9: Please specify the reasons why your responsibility has changed. 


Increased Decreased 
(Base: 164) (Base: 14) 


Increase in FOI requests/ workload 73% 
Improvement in security / increased public awareness 10% 
Changes to legislation 6% 
Change in job role 6% 
Intemal company review / changes 6% 
More people are dealing with it 3% 
We have less resourcesto deal with it 3% 


More than three quarters (78%) of respondents whose FOI responsibility had 
increased said it was due to increased FOI requests and workload. Of the 14 
respondents who said their FOI responsbility had decreased, 43% said the 
change had arisen from an increase in the number of people dealing with 
FOI, and 29% said it wasa results of a change in theirjob role. 


Reasons forchange 


6.4.4 Additional resources within the organisation 


Q11: How many staff members are there in your organisation working on data protection and/or freedom of 
information duties? (Private sector) 


tage |  smawmedim Overal 
Number of staff 


One other 
2-5 staff 
5-10 staff 


wore thana0 | | 259| 35% | aon] 35| av | 139| 221| 2000| aor] 3% 19 | 2096] 31% 


Around three quarters (76%) of private sector respondents said that there are 
others in their organisation working on data protection and/or freedom of 
information duties, an increase of 24% since 2010. Slightly fewer respondents 
within public sector organisations said there were others who assisted with the 
DP/FOI duties (70%). 


Q11: How many staff members are there in your organisation working on data protection and/or freedom of 
information duties? (Public sector 


2008] 2009| 2010 


Number of staff 


One other 
2-5 staff 

5 - 10 staff 
More than 10 


As in previous years, larger private organisations are more likely to have 
allocated more human resources to data protection than smaller private 
organisations; however the opposite was found within public sector 
organisations. 


6.4.5 Type of personal information held 


Q12: Does your organisation hold any information about any of the following? 


(Prompted) 


Employees 


Suppliers 
Customers 


Clients 


Similar to previous years, the vast majority of organisations held information 
about their employees (99%) and suppliers (93%); most organisations also held 
information about their customers (87%) and clients (84%). 
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7.0 Appendices 


7.1 Organisation Tables 


Private Sector 
Organisation Type Number 

Transportation, storage, information and communication 51 
Financial and insurance activities 50 
Professional, scientific and technical 49 
Human, health and social work activities 41 
Other service activities (including third sector 38 
organisations) 

Wholesale and retail trade / repair 31 
Construction 30 
Manufacturing 23 
Admin and support service activities 23 
Education 17 
Arts, entertainment and recreation 14 
Agriculture, forestry and fishing 13 
Accommodation and food service 11 
Real estate activities 7 
Mining, electricity, gasand water 2 
TOTAL 400 


Q13: How many employees are employed by your organisation? 


Number of employees Private Sector 
72 
Small Organisation 51-100 73 
101-200 58 
Sa 201-500 84 
Large Organisation 


Public Sector (Small/Medium) 
Organisation Type 


Fire authorities 

Police authorities 

Mental health authorities 
Intemal drainage boards 
Magistrates court committees 
District courts and sheriff courts 
Passenger transport executives 
District drainage commissioners 
Waste authorities 
Passenger transport authorities 
National parks 

Parish / community councils 
Independent practitioners 
Ambulance trusts 

Local health boards 

Trusts (Wales) 

Health regulators 

Community health councils 
HSS trusts agencies and councils 
Secondary schools 

Primary schools 

District policing partnerships 
TOTAL 


Number 
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Public Sector (Large) 


Organisation Type Number 
Central Govemment Departments 32 
Non-departmental public bodies 6 
Local authorities 72 


District Councils (Northem Ireland) 
Welsh Local Authonties 


Police forces 27 
Primary Care Trusts 18 
Strategic Health Authorities 5 
Higher education 38 
Scottish authorities 1 
Acute trusts 9 
Further education colleges 14 
TOTAL 229 


1-50 
51-100 
101-200 
201-500 
501+ 


Q13: How many employees are employed by your organisation? 
Number of employees Public Sector 
75 
23 
20 
68 
220 


